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IN THE CLAIMS 

1 . (Original) A method for gathering and monitoring the simultaneous status 
of nodes in a storage area network (SAN), comprising: 

receiving alert messages corresponding to status events in the storage 
area network, each status event having a corresponding event category and 
severity value; 

aggregating the alert messages according to event category and severity 
value to generate a category specific severity ranking of the alert messages; 

displaying a status array having a plurality of chart entries, each chart 
entry corresponding to alert messages of a particular event category and each 
chart entry having a node entry for each node having status attributable to the 
alert messages; and 

displaying, within at least one chart entry, node entries having a status 
event associated with the event category for that chart entry, the node entries 
displayed in the chart entry according to the severity ranking and each node 
entry indicative of a severity scale of status for the corresponding effected node. 

2. (Previously Presented) The method of claim 1 wherein displaying, within 
the at least one chart entry, comprises: 

accumulating events of each of a plurality of severity levels, each severity 
level representing a range of severity values such that a given status event with a 
given severity value has a corresponding severity level when the given severity 
value of the given status event is within a range of severity values for the 
corresponding severity level, wherein the severity scale for a node entry is an 
enumeration of events received for each of the plurality of severity levels within 
the severity ranking, the severity ranking determined by the severity scale for 
each node entry; and 

displaying the enumeration of events received for each node entry within 
the at least one chart entry containing that node entry, the enumeration of events 
received being displayed in an order according to the severity ranking. 



U.S. Application No.: 1 0/674,322 Attorney Docket No.: EMC03-1 2(021 69) 

-3- 



3. (Original) The method of claim 2 wherein the enumeration is a histogram 
having a magnitude based on the severity scale and a quantity of events within 
each severity level within the severity ranking. 

4. (Original) The method of claim 3 wherein the histogram has a plurality of 
visually overlapping elongated bar segments, each elongated bar segment 
corresponding to a particular severity level. 

5. (Original) The method of claim 1 further including discovering a topology 
of nodes in the SAN, wherein the alert messages correspond to status events for 
each of a plurality of selected nodes in a selection tree, the selection tree 
indicative of the nodes in the SAN. 

6. (Original) The method of claim 1 further including filtering the status 
events to compute a subset of elected events, wherein the received events 
correspond to elected events determined in response to predetermined filtering 
logic at the agents processing the elected events. 

7. (Original) The method of claim 1 wherein each chart entry has a 
magnitude axis, the magnitude axis indicative of a relative range of the quantity 
of status events within each of the severity levels corresponding to a plurality of 
node entries reflected in the chart entry. 

8. (Previously Presented) The method of claim 1 wherein each chart entry 
has a manageable entity axis, the manageable entity axis arranged, for each 
node, according to increasing severity scale denoting the severity ranking for 
each node included in the chart entry, and further comprising computing the 
severity scale for each node according to a predetermined severity metric. 
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9. (Original) The method of claim 1 wherein the severity level corresponds to 
a threshold value, the threshold value identifying triggering of an event having the 
corresponding severity level. 

10. (Original) The method of claim 1 wherein each event in an event category 
has a set of threshold values, the threshold values indicative of a quantitative 
metric triggering the particular event and severity. 

1 1 . (Original) The method of claim 1 0 further comprising processing and 
propagating the threshold values to remote agents, the remote agents operable 
to analyze nodes and determine when a particular metric satisfying a triggering 
threshold is attained and generate the corresponding event. 

12. (Original) The method of claim 1 wherein the nodes further comprise 
manageable entities, the manageable entities responsive to the server in a SAN 
and further including storage entities, connectivity entities, and database entities. 

13. (Original) The method of claim 1 further comprising selectively 
suppressing events of a particular category and severity. 

14. (Original) The method of claim 1 wherein the chart entries in the status 
array are further subdivided into chart entries directed to manageable entity 
health, manageable entity performance, and storage system capacity. 

15. (Original) The method of claim 1 comprising: 

receiving a selection of at least one node in a hierarchical 
arrangement of nodes; and 

wherein receiving, aggregating, displaying a status array, and displaying, 
within at least one chart entry, node entries are performed in relation to the 
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selected at least one node in order to display the simultaneous status of nodes in 
a storage area network. 

16. (Original) The method of claim 1 wherein: 

the status array is an N by M matrix of the plurality of chart entries, 
the plurality of chart entries including: 

i) a general alert chart entry displaying alert status of managed 
entities in the storage area network; 

ii) a storage chart entry indicating alert status of managed storage 
entities in the storage area network; 

iii) a host chart entry indicating alert status of managed host entities 
in the storage area network; and 

iv) a connectivity chart entry indicating alert status of managed 
connectivity entities in the storage area network. 

17. (Original) The method of claim 1 further comprising 

receiving a user input corresponding to selection of at least one node 
entry from among the node entries displayed in the status array; 

displaying an expanded menu of status options for the selected entry; and 
receiving a response to the menus of status options and displaying an 
expanded status report corresponding to the expanded menu. 

18. (Original) A network monitoring device for gathering and monitoring the 
simultaneous status of nodes in a storage area network (SAN), comprising: 

a server having a correlator operable to receive alert messages 
corresponding to status events in the storage area network, each status event 
having a corresponding event category and severity value; 

an aggregator operable to aggregate the alert messages according 
to event category and severity value to generate a category specific severity 
ranking of the alert messages; and 
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an operator console operable to display a status array having a plurality of 
chart entries, each chart entry corresponding to alert messages of a particular 
event category and each chart entry having a node entry for each node having 
status attributable to the alert messages, the console further operable to display, 
within at least one chart entry, node entries having a status event associated with 
the event category for that chart entry, the node entries displayed in the chart 
entry according to the severity ranking and each node entry indicative of a 
severity scale of status for the corresponding effected node. 

19. (Previously Presented) The network monitoring device of claim 18 
wherein the accumulator is further operable to: 

accumulate events of each of a plurality of severity levels, each severity 
level representing a range of severity values such that a given status event with a 
given severity value has a corresponding severity level when the given severity 
value of the given status event is within a range of severity values for the 
corresponding severity level, wherein the severity scale for a node entry is an 
enumeration of events received for each of the plurality of severity levels within 
the severity ranking, the severity ranking determined by the severity scale for 
each node entry; and 

display, within the at least one chart entry, the enumeration of events 
received for each node entry within the at least one chart entry containing that 
node entry, the enumeration of events received being displayed in an order 
according to the severity ranking. 

20. (Original) The network monitoring device of claim 19 wherein the 
enumeration is a histogram having a magnitude based on the severity scale and 
a quantity of events within each severity level within the severity ranking. 



U.S. Application No.: 1 0/674,322 Attorney Docket No.: EMC03-1 2(021 69) 

-7- 

21. (Original) The network monitoring device of claim 20 wherein the 
histogram has a plurality of visually overlapping elongated bar segments, each 
elongated bar segment corresponding to a particular severity level. 

22. (Original) The network monitoring device of claim 18 wherein the server is 
further operable to discover a topology of nodes in the SAN, wherein the alert 
messages correspond to status events for each of a plurality of selected nodes in 
a selection tree, the selection tree indicative of the nodes in the SAN. 

23. (Original) The network monitoring device of claim 18 wherein the server is 
further operable to filter the status events to compute a subset of elected events, 
wherein the received events correspond to elected events determined in 
response to predetermined filtering logic at the agents processing the elected 
events. 

24. (Original) The network monitoring device of claim 18 wherein each chart 
entry has a magnitude axis, the magnitude axis indicative of a relative range of 
the quantity of status events within each of the severity levels corresponding to a 
plurality of node entries reflected in the chart entry. 

25. (Previously Presented) The network monitoring device of claim 18 
wherein each chart entry has a manageable entity axis, the manageable entity 
axis arranged, for each node, according to increasing severity scale denoting the 
severity ranking for each node included in the chart entry, and further comprising 
computing the severity scale for each node according to a predetermined 
severity metric. 

26. (Original) The network monitoring device of claim 18 wherein the severity 
level corresponds to a threshold value, the threshold value identifying triggering 
of an event having the corresponding severity level. 
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27. (Original) The network monitoring device of claim 18 wherein each event 
in an event category has a set of threshold values, the threshold values indicative 
of a quantitative metric triggering the particular event and severity. 

28. (Original) The network monitoring device of claim 27 wherein the server is 
further operable to processing and propagating the threshold values to remote 
agents, the remote agents operable to analyze nodes and determine when a 
particular metric satisfying a triggering threshold is attained and generate the 
corresponding event. 

29. (Original) The network monitoring device of claim 18 wherein the nodes 
further comprise manageable entities, the manageable entities responsive to the 
server in a SAN and further including storage entities, connectivity entities, and 
database entities. 

30. (Original) The network monitoring device of claim 18 wherein the server is 
operable to selectively suppress events of a particular category and severity. 

31 . (Original) The network monitoring device of claim 18 wherein the chart 
entries in the status array are further subdivided into chart entries directed to 
manageable entity health, manageable entity performance, and storage system 
capacity. 

32. (Original) The network monitoring device of claim 18 wherein the server is 
further operable to receive a selection of at least one node in a hierarchical 
arrangement of nodes, and display, within at least one chart entry, node entries 
in relation to the selected at least one node in order to display the simultaneous 
status of nodes in a storage area network. 
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33. (Original) The network monitoring device of claim 18 wherein: 

the status array is an N by M matrix of the plurality of chart entries, 
the plurality of chart entries including: 

i) a general alert chart entry displaying alert status of managed 
entities in the storage area network; 

ii) a storage chart entry indicating alert status of managed storage 
entities in the storage area network; 

iii) a host chart entry indicating alert status of managed host entities 
in the storage area network; and 

iv) a connectivity chart entry indicating alert status of managed 
connectivity entities in the storage area network. 

34. (Original) The network monitoring device of claim 18 wherein the server is 
further operable to: 

receive a user input corresponding to selection of at least one node entry 

from among the node entries displayed in the status array; 

display an expanded menu of status options for the selected entry; and 
display an expanded status report corresponding to the expanded menu 

and a response to the menu of status options. 

35. (Original) A computer program product having a computer readable 
medium operable to store computer program logic embodied in computer 
program code encoded thereon forgathering and monitoring the simultaneous 
status of nodes in a storage area network (SAN), comprising: 

computer program code for receiving alert messages 
corresponding to status events in the storage area network, each status event 
having a corresponding event category and severity value; 

computer program code for aggregating the alert messages 
according to event category and severity value to generate a category specific 
severity ranking of the alert messages; 
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computer program code for displaying a status array having a plurality of 
chart entries, each chart entry corresponding to alert messages of a particular 
event category and each chart entry having a node entry for each node having 
status attributable to the alert messages; and 

computer program code for displaying, within at least one chart entry, 
node entries having a status event associated with the event category for that 
chart entry, the node entries displayed in the chart entry according to the severity 
ranking and each node entry indicative of a severity scale of status for the 
corresponding effected node. 

36. Canceled. 

37. (Original) A network monitoring device for gathering and monitoring the 
simultaneous status of nodes in a storage area network (SAN), comprising: 

means for receiving alert messages corresponding to status events in the 
storage area network, each status event having a corresponding event category 
and severity value; 

means for aggregating the alert messages according to event category 
and severity value to generate a category specific severity ranking of the alert 
messages; 

means for displaying a status array having a plurality of chart entries, each 
chart entry corresponding to alert messages of a particular event category and 
each chart entry having a node entry for each node having status attributable to 
the alert messages; and 

means for displaying, within at least one chart entry, node entries having a 
status event associated with the event category for that chart entry, the node 
entries displayed in the chart entry according to the severity ranking and each 
node entry indicative of a severity scale of status for the corresponding effected 
node. 
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38. (Previously Presented) The method of claim 1 , wherein the severity 
scale for each node entry is an aggregate value representative of a number of 
alert messages received at each node entry for a given sampling interval, 
wherein each node entry is weighted with respect to a corresponding severity 
level for each alert message, each severity level representing a range of severity 
values such that a given status event with a given severity value has a 
corresponding severity level when the given severity value of the given status 
event is within a range of severity values for the corresponding severity level. 

39. (Previously Presented) The network monitoring device of claim 18, 
wherein the severity scale for each node entry is an aggregate value 
representative of a number of alert messages received at each node entry for a 
given sampling interval , wherein each node entry is weighted with respect to a 
corresponding severity level for each alert message, each severity level 
representing a range of severity values such that a given status event with a 
given severity value has a corresponding severity level when the given severity 
value of the given status event is within a range of severity values for the 
corresponding severity level. 

40. (Previously Presented) The computer program product of claim 35, 
wherein the severity scale for each node entry is an aggregate value 
representative of a number of alert messages received at each node entry for a 
given sampling interval, wherein each node entry is weighted with respect to a 
corresponding severity level for each alert message, each severity level 
representing a range of severity values such that a given status event with a 
given severity value has a corresponding severity level when the given severity 
value of the given status event is within a range of severity values for the 
corresponding severity level. 



41. Canceled. 
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42. (Previously Presented) The network monitoring device of claim 37, 
wherein the severity scale for each node entry is an aggregate value 
representative of a number of alert messages received at each node entry for a 
given sampling interval, wherein each node entry is weighted with respect to a 
corresponding severity level for each alert message, each severity level 
representing a range of severity values such that a given status event with a 
given severity value has a corresponding severity level when the given severity 
value of the given status event is within a range of severity values for the 
corresponding severity level. 

43. (New) A method for gathering and monitoring the simultaneous status of 
nodes in a storage area network (SAN), comprising: 

discovering a topology of notes in the SAN; 

propagating threshold values to remote agents, wherein responsive to the 
threshold values, the remote agents operable to analyze nodes and determine 
when a particular metric satisfying a triggering threshold is attained, and to 
generate a corresponding status event as an alert message; 

receiving alert messages, from the remote agents, corresponding to status 
events in the storage area network, each status event having a corresponding 
event category and severity value; 

storing status events in an event repository; 

aggregating the alert messages according to event category and severity 
value to generate a category specific severity ranking of the alert messages; 

displaying a status array having a plurality of chart entries, each chart 
entry corresponding to alert messages of a particular event category and each 
chart entry having a node entry for each node having status attributable to the 
alert messages; and 

displaying, within at least one chart entry, node entries having a status 
event associated with the event category for that chart entry, the node entries 
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displayed in the chart entry according to the severity ranking and each node 
entry indicative of a severity scale of status for the corresponding effected node, 
wherein the severity scale for a node entry is an enumeration of events received 
for each of a plurality of severity levels with the severity ranking. 

44. (New) The method of claim 43 wherein the chart entries in the status array 
are further subdivided into chart entries directed to manageable entity health, 
manageable entity performance, and storage system capacity. 



